Cybersecurity firm Malwarebytes has identified a wave of fake crypto anti-money laundering checkers designed to drain users' wallets by tricking them into connecting their wallets and approving malicious transactions.
According to a report published Wednesday, the fraudulent sites impersonate legitimate AML services such as AMLBot and use generic names like "AML Check." A basic AML check requires only a wallet's public address and does not require users to connect a wallet, approve permissions, or sign a transaction. The fake sites instead prompt victims to connect their wallets, then simulate scans with fake progress messages and results. One site asked users for a small top-up to cover a supposed fee before returning a "Clean, Low Risk" result regardless of whether a genuine check occurred.
"If an AML checker asks you to connect your wallet rather than simply enter its public address, treat that as a warning sign," Malwarebytes researchers wrote. Connecting a wallet alone does not allow scammers to steal funds, but it reveals the wallet's public address, enabling attackers to view assets and create a transaction for the victim to approve.
Malwarebytes found the same basic design and process under several names and logos, suggesting the scam template is being reused and rebranded. The warning follows other phishing campaigns: hardware wallet makers Trezor and Foundation recently warned of phishing emails directing users to a cloned Coldcard website, and in March Malwarebytes uncovered a fake version of Pudgy Penguins' Pudgy World game. Crypto exchange CoinDCX said it identified more than 1,200 websites impersonating its platform between April 2024 and January 2026.
Malwarebytes advised users who approved token access to revoke suspicious permissions. Users who entered a recovery phrase or private key should consider the wallet compromised and move assets to a new wallet. "Crypto transactions generally can't be reversed once they're confirmed, so acting quickly matters if you've approved something suspicious," the firm said.
